{"schema":"threatline.record/2","record":{"id":"CVE-2026-114094","aliases":["GHSA-8mcx-5rqc-vhmf"],"summary":"Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths","details":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.","categories":["Libraries & packages"],"product":"dulwich","vendor":"jelmer","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114094","source_modified_at":"2026-10-21T00:36:58.401Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"dulwich","vendor":"jelmer","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"1.2.9"},{"version":"1.2.9","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8mcx-5rqc-vhmf","source_modified_at":"2026-10-21T10:57:27.354775093Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"dulwich","purl":"pkg:pypi/dulwich"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.9"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.1.0","0.1.1","0.10.0","0.10.1a","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.3","0.17.1","0.17.2","0.17.3","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.15","0.19.16","0.19.2","0.19.3","0.19.3a0","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.2.1","0.20.0","0.20.1","0.20.10","0.20.11"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114094","source_modified_at":"2026-10-21T00:36:58.401Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"dulwich","ecosystem":null},"version":"1.2.9","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8mcx-5rqc-vhmf","source_modified_at":"2026-10-21T10:57:27.354775093Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"dulwich","purl":"pkg:pypi/dulwich"},"version":"1.2.9"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0067,"percentile":0.51433,"score_date":"2026-10-23"},"published_at":"2026-10-21T00:36:58.401Z","modified_at":"2026-10-21T10:57:27.354775093Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114094","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T00:36:58.401Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8mcx-5rqc-vhmf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T10:57:27.354775093Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114094","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/dulwich-before-1.2.9-arbitrary-file-write-via-dos-drive-letter-paths","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T10:57:27.354775093Z","content_hash":"f1e75a6ecb5387e262b55ff1f3682e9abe6bb940727f640cb518de9a5c3d9009"}}